2017 CVEs (page 37)
Page 37 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-12114 | Medium | 6.8 | 2018-01-19 | An exploitable improper authorization vulnerability exists in admin_peers API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d001618a7ce82c7c073768). A J… |
CVE-2017-12112 | High | 8.1 | 2018-01-19 | An exploitable improper authorization vulnerability exists in admin_addPeer API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d001618a7ce82c7c073768). A… |
CVE-2017-12097 | Medium | 6.1 | 2018-01-19 | An exploitable cross site scripting (XSS) vulnerability exists in the filter functionality of the delayed_job_web rails gem version 1.4. A specially crafted UR… |
CVE-2017-14097 | Critical | 9.8 | 2018-01-19 | An improper access control vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to decrypt contents… |
CVE-2017-14096 | Medium | 6.1 | 2018-01-19 | A stored cross site scripting (XSS) vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to execute… |
CVE-2017-14095 | High | 8.1 | 2018-01-19 | A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to perform remote command execution via a lo… |
CVE-2017-14094 | Critical | 9.8 | 2018-01-19 | A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to perform remote command execution via a cr… |
CVE-2017-14082 | High | 7.5 | 2018-01-19 | An uninitialized pointer information disclosure vulnerability in Trend Micro Mobile Security (Enterprise) versions 9.7 and below could allow an unauthenticated… |
CVE-2017-12098 | Medium | 6.1 | 2018-01-19 | An exploitable cross site scripting (XSS) vulnerability exists in the add filter functionality of the rails_admin rails gem version 1.2.0. A specially crafted… |
CVE-2017-11398 | High | 8.8 | 2018-01-19 | A session hijacking via log disclosure vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an unauthenticated… |
CVE-2017-7327 | High | 7.8 | 2018-01-19 | Yandex Browser installer for Desktop before 17.4.1 has a DLL Hijacking Vulnerability because an untrusted search path is used for dnsapi.dll, winmm.dll, ntmart… |
CVE-2017-7326 | High | 7.5 | 2018-01-19 | Race condition issue in Yandex Browser for Android before 17.4.0.16 allowed a remote attacker to potentially exploit memory corruption via a crafted HTML page |
CVE-2017-7325 | High | 7.5 | 2018-01-19 | Yandex Browser before 16.9.0 allows remote attackers to spoof the address bar via window.open. |
CVE-2017-18044 | Critical | 9.8 | 2018-01-19 | A Command Injection issue was discovered in ContentStore/Base/CVDataPipe.dll in Commvault before v11 SP6. A certain message parsing function inside the Commvau… |
CVE-2017-15713 | Medium | 6.5 | 2018-01-19 | Vulnerability in Apache Hadoop 0.23.x, 2.x before 2.7.5, 2.8.x before 2.8.3, and 3.0.0-alpha through 3.0.0-beta1 allows a cluster user to expose private files… |
CVE-2017-6142 | Medium | 4.8 | 2018-01-19 | X509 certificate verification was not correctly implemented in the early access "user id" feature in the F5 BIG-IP Advanced Firewall Manager versions 13.0.0, 1… |
CVE-2017-1693 | Medium | 5.6 | 2018-01-19 | IBM Integration Bus 9.0 and 10.0 could allow an attacker that has captured a valid session id to hijack another users session during a small timeframe before t… |
CVE-2017-17860 | Medium | 5.7 | 2018-01-18 | In Samsung Gear products, Bluetooth link key is updated to the different key which is same with attacker's link key. It can be attacked without user's intentio… |
CVE-2017-12197 | Medium | 6.5 | 2018-01-18 | It was found that libpam4j up to and including 1.8 did not properly validate user accounts when authenticating. A user with a valid password for a disabled acc… |
CVE-2017-3158 | High | 8.1 | 2018-01-18 | A race condition in Guacamole's terminal emulator in versions 0.9.5 through 0.9.10-incubating could allow writes of blocks of printed data to overlap. Such ove… |
CVE-2017-5170 | High | 7.2 | 2018-01-18 | An Uncontrolled Search Path Element issue was discovered in Moxa SoftNVR-IA Live Viewer, Version 3.30.3122 and prior versions. An uncontrolled search path elem… |
CVE-2017-12729 | Critical | 9.8 | 2018-01-18 | A SQL Injection issue was discovered in Moxa SoftCMS Live Viewer through 1.6. An improper neutralization of special elements used in an SQL command ('SQL Injec… |
CVE-2017-16863 | Medium | 6.1 | 2018-01-18 | The PieChart gadget in Atlassian Jira before version 7.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vuln… |
CVE-2017-18033 | Medium | 6.5 | 2018-01-18 | The Jira-importers-plugin in Atlassian Jira before version 7.6.1 allows remote attackers to create new projects and abort an executing external system import v… |
CVE-2017-15869 | Medium | 6.1 | 2018-01-18 | Cross-site scripting (XSS) vulnerability in knowledgebase.php in LiveZilla before 7.0.8.9 allows remote attackers to inject arbitrary web script or HTML via th… |
CVE-2017-12308 | Medium | 6.1 | 2018-01-18 | A vulnerability in the web framework of Cisco Small Business Managed Switches software could allow an unauthenticated, remote attacker to conduct an HTTP respo… |
CVE-2017-12307 | Medium | 6.1 | 2018-01-18 | A vulnerability in the web framework of Cisco Small Business Managed Switches software could allow an unauthenticated, remote attacker to conduct a reflected c… |
CVE-2017-5699 | Medium | 5.5 | 2018-01-18 | Input validation error in Intel MinnowBoard 3 Firmware versions prior to 0.65 allow local attacker to cause denial of service via UEFI APIs. |
CVE-2017-10301 | High | 8.1 | 2018-01-18 | Vulnerability in the PeopleSoft Enterprise PRTL Interaction Hub component of Oracle PeopleSoft Products (subcomponent: Enterprise Portal). The supported versio… |
CVE-2017-10282 | Critical | 9.1 | 2018-01-18 | Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 12.1.0.2 and 12.2.0.1. Easily exploitable vulnera… |
CVE-2017-10273 | Medium | 4.7 | 2018-01-18 | Vulnerability in the Oracle JDeveloper component of Oracle Fusion Middleware (subcomponent: Deployment). Supported versions that are affected are 11.1.1.7.0, 1… |
CVE-2017-10262 | Medium | 5.9 | 2018-01-18 | Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Web Server Plugin). The supported version that is affected is 1… |
CVE-2017-10068 | High | 8.2 | 2018-01-18 | Vulnerability in the Oracle Business Intelligence Enterprise Edition component of Oracle Fusion Middleware (subcomponent: Analytics Web Dashboards). The suppor… |
CVE-2017-5696 | High | 7.8 | 2018-01-18 | Untrusted search path in Intel Graphics Driver 15.40.x.x, 15.45.x.x, and 21.20.x.x allows unprivileged user to elevate privileges via local access. |
CVE-2017-16865 | Medium | 5.3 | 2018-01-17 | The Trello importer in Atlassian Jira before version 7.6.1 allows remote attackers to access the content of internal network resources via a Server Side Reques… |
CVE-2017-17947 | Medium | 4.8 | 2018-01-16 | A cross site scripting issue has been found in custompage.cgi in Pulse Secure Pulse Connect Secure (PCS) before 8.0R17.0, 8.1.x before 8.1R13, 8.2.x before 8.2… |
CVE-2017-8802 | Medium | 5.4 | 2018-01-16 | Cross-site scripting (XSS) vulnerability in Zimbra Collaboration Suite (aka ZCS) before 8.8.0 Beta2 might allow remote attackers to inject arbitrary web script… |
CVE-2017-17429 | Medium | 5.5 | 2018-01-16 | In K7 Antivirus Premium before 15.1.0.53, user-controlled input to the K7Sentry device is not sufficiently authenticated: a local user with a LOW integrity pro… |
CVE-2017-16557 | High | 7.0 | 2018-01-16 | K7 Antivirus Premium before 15.1.0.53 allows local users to gain privileges by sending a specific IOCTL after setting the memory in a particular way. |
CVE-2017-16556 | Medium | 5.5 | 2018-01-16 | In K7 Antivirus Premium before 15.1.0.53, user-controlled input can be used to allow local users to write to arbitrary memory locations. |
CVE-2017-16555 | High | 7.0 | 2018-01-16 | K7 Antivirus Premium before 15.1.0.53 allows local users to gain privileges by sending a specific IOCTL after setting the memory in a particular way. |
CVE-2017-16554 | High | 7.8 | 2018-01-16 | K7 Antivirus Premium before 15.1.0.53 allows local users to write to arbitrary memory locations, and consequently gain privileges, via a specific set of IOCTL… |
CVE-2017-16553 | High | 7.0 | 2018-01-16 | K7 Antivirus Premium before 15.1.0.53 allows local users to gain privileges by sending a specific IOCTL after setting the memory in a particular way. |
CVE-2017-16552 | High | 7.8 | 2018-01-16 | K7 Antivirus Premium before 15.1.0.53 allows local users to write to arbitrary memory locations, and consequently gain privileges, via a specific set of IOCTL… |
CVE-2017-16551 | High | 7.0 | 2018-01-16 | K7 Antivirus Premium before 15.1.0.53 allows local users to gain privileges by sending a specific IOCTL after setting the memory in a particular way. |
CVE-2017-16550 | High | 7.8 | 2018-01-16 | K7 Antivirus Premium before 15.1.0.53 allows local users to write to arbitrary memory locations, and consequently gain privileges, via a specific set of IOCTL… |
CVE-2017-16549 | High | 7.8 | 2018-01-16 | K7 Antivirus Premium before 15.1.0.53 allows local users to write to arbitrary memory locations, and consequently gain privileges, via a specific set of IOCTL… |
CVE-2017-11072 | High | 7.8 | 2018-01-16 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while calculating CRC for GPT header fields wit… |
CVE-2017-18032 | Medium | 6.1 | 2018-01-16 | The download-manager plugin before 2.9.52 for WordPress has XSS via the id parameter in a wpdm_generate_password action to wp-admin/admin-ajax.php. |
CVE-2017-15128 | Medium | 5.5 | 2018-01-14 | A flaw was found in the hugetlb_mcopy_atomic_pte function in mm/hugetlb.c in the Linux kernel before 4.13.12. A lack of size check could cause a denial of serv… |
CVE-2017-15127 | Medium | 5.5 | 2018-01-14 | A flaw was found in the hugetlb_mcopy_atomic_pte function in mm/hugetlb.c in the Linux kernel before 4.13. A superfluous implicit page unlock for VM_SHARED hug… |
CVE-2017-15126 | High | 8.1 | 2018-01-14 | A use-after-free flaw was found in fs/userfaultfd.c in the Linux kernel before 4.13.6. The issue is related to the handling of fork failure when dealing with e… |
CVE-2017-13226 | High | 7.8 | 2018-01-12 | An elevation of privilege vulnerability in the MediaTek mtk. Product: Android. Versions: Android kernel. Android ID: A-32591194. References: M-ALPS03149184. |
CVE-2017-13225 | High | 7.8 | 2018-01-12 | In libMtkOmxVdec.so there is a possible heap buffer overflow. This could lead to a remote elevation of privilege enabling code execution as a privileged proces… |
CVE-2017-13222 | High | 7.5 | 2018-01-12 | An information disclosure vulnerability in the Upstream kernel kernel. Product: Android. Versions: Android kernel. Android ID: A-38159576. |
CVE-2017-13221 | High | 7.8 | 2018-01-12 | An elevation of privilege vulnerability in the Upstream kernel wifi driver. Product: Android. Versions: Android kernel. Android ID: A-64709938. |
CVE-2017-13220 | High | 7.8 | 2018-01-12 | An elevation of privilege vulnerability in the Upstream kernel bluez. Product: Android. Versions: Android kernel. Android ID: A-63527053. |
CVE-2017-13219 | High | 7.5 | 2018-01-12 | A denial of service vulnerability in the Upstream kernel synaptics touchscreen controller. Product: Android. Versions: Android kernel. Android ID: A-62800865. |
CVE-2017-13218 | Medium | 4.7 | 2018-01-12 | Access to CNTVCT_EL0 in Small Cell SoC, Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear could be used for side channel attacks and this could lead… |
CVE-2017-13217 | High | 7.8 | 2018-01-12 | In DisplayFtmItem in the bootloader, there is an out-of-bounds write due to reading a string without verifying that it's null-terminated. This could lead to a… |
CVE-2017-13216 | High | 7.8 | 2018-01-12 | In ashmem_ioctl of ashmem.c, there is an out-of-bounds write due to insufficient locking when accessing asma. This could lead to a local elevation of privilege… |
CVE-2017-13215 | High | 7.8 | 2018-01-12 | A elevation of privilege vulnerability in the Upstream kernel skcipher. Product: Android. Versions: Android kernel. Android ID: A-64386293. References: Upstrea… |
CVE-2017-13214 | High | 7.5 | 2018-01-12 | In the hardware HEVC decoder, some media files could cause a page fault. This could lead to a remote denial of service of a critical system process with no add… |
CVE-2017-13213 | High | 7.8 | 2018-01-12 | An elevation of privilege vulnerability in the Broadcom bcmdhd driver. Product: Android. Versions: Android kernel. Android ID: A-63374465. References: B-V20170… |
CVE-2017-13212 | High | 7.8 | 2018-01-12 | An elevation of privilege vulnerability in the Android system (systemui). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-… |
CVE-2017-13211 | High | 7.5 | 2018-01-12 | In bta_scan_results_cb_impl of btif_ble_scanner.cc, there is possible resource exhaustion if a large number of repeated BLE scan results are received. This cou… |
CVE-2017-13210 | High | 7.8 | 2018-01-12 | In CameraDeviceClient::submitRequestList of CameraDeviceClient.cpp, there is an out-of-bounds write if metadataSize is too small. This could lead to a local el… |
CVE-2017-13209 | High | 7.8 | 2018-01-12 | In the ServiceManager::add function in the hardware service manager, there is an insecure permissions check based on the PID of the caller which could allow an… |
CVE-2017-13208 | Critical | 9.8 | 2018-01-12 | In receive_packet of libnetutils/packet.c, there is a possible out-of-bounds write due to a missing bounds check on the DHCP response. This could lead to remot… |
CVE-2017-13207 | High | 7.5 | 2018-01-12 | An information disclosure vulnerability in the Android media framework (stagefright mpeg4writer). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android I… |
CVE-2017-13206 | High | 7.5 | 2018-01-12 | An information disclosure vulnerability in the Android media framework (aacdec). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. An… |
CVE-2017-13205 | Critical | 9.1 | 2018-01-12 | An information disclosure vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-64550… |
CVE-2017-13204 | Critical | 9.1 | 2018-01-12 | An information disclosure vulnerability in the Android media framework (libavc). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-6438023… |
CVE-2017-13203 | Critical | 9.1 | 2018-01-12 | An information disclosure vulnerability in the Android media framework (libavc). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-6312263… |
CVE-2017-13202 | High | 7.5 | 2018-01-12 | An information disclosure vulnerability in the Android media framework (libeffects). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1… |
CVE-2017-13201 | High | 7.5 | 2018-01-12 | An information disclosure vulnerability in the Android media framework (mediadrm). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1… |
CVE-2017-13200 | High | 7.5 | 2018-01-12 | An information disclosure vulnerability in the Android media framework (av) related to id3 unsynchronization. Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8… |
CVE-2017-13199 | High | 7.5 | 2018-01-12 | In Bitmap.ccp if Bitmap.nativeCreate fails an out of memory exception is not thrown leading to a java.io.IOException later on. This could lead to a remote deni… |
CVE-2017-13198 | High | 7.5 | 2018-01-12 | A vulnerability in the Android media framework (ex) related to composition of frames lacking a color map. Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8… |
CVE-2017-13197 | High | 7.5 | 2018-01-12 | In the ihevcd_parse_slice.c function, slave threads are not joined if there is an error. This could lead to a remote denial of service of a critical system pro… |
CVE-2017-13196 | High | 7.5 | 2018-01-12 | In several places in ihevcd_decode.c, a dead loop could occur due to incomplete frames which could lead to memory leaks. This could lead to a remote denial of… |
CVE-2017-13195 | High | 7.5 | 2018-01-12 | In the ihevcd_parse_sps function of ihevcd_parse_headers.c, several parameter values could be negative which could lead to negative indexes which could lead to… |
CVE-2017-13194 | High | 7.5 | 2018-01-12 | A vulnerability in the Android media framework (libvpx) related to odd frame width. Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-6471… |
CVE-2017-13193 | High | 7.5 | 2018-01-12 | In ihevcd_decode.c there is a possible infinite loop due to bytes for an sps of unsupported resolution resulting in the same sps being fed in over and over. Th… |
CVE-2017-13192 | High | 7.5 | 2018-01-12 | In the ihevcd_parse_slice_header function of ihevcd_parse_slice_header.c a slice address of zero after the first slice could result in an infinite loop. This c… |
CVE-2017-13191 | High | 7.5 | 2018-01-12 | In the ihevcd_decode function of ihevcd_decode.c, there is an infinite loop due to an incomplete frame error. This could lead to a remote denial of service of… |
CVE-2017-13190 | High | 7.5 | 2018-01-12 | A vulnerability in the Android media framework (libhevc) related to handling ps_codec_obj memory allocation failures. Product: Android. Versions: 7.0, 7.1.1, 7… |
CVE-2017-13189 | High | 7.5 | 2018-01-12 | A vulnerability in the Android media framework (libavc) related to handling dec_hdl memory allocation failures. Product: Android. Versions: 7.0, 7.1.1, 7.1.2… |
CVE-2017-13188 | Critical | 9.1 | 2018-01-12 | An information disclosure vulnerability in the Android media framework (aac). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-65280786. |
CVE-2017-13187 | Critical | 9.1 | 2018-01-12 | An information disclosure vulnerability in the Android media framework (libhevc). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-650341… |
CVE-2017-13186 | High | 7.5 | 2018-01-12 | A vulnerability in the Android media framework (libavc) related to incorrect use of mmco parameters. Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. A… |
CVE-2017-13185 | Critical | 9.1 | 2018-01-12 | An information disclosure vulnerability in the Android media framework (libhevc). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-65123471. |
CVE-2017-13184 | High | 7.8 | 2018-01-12 | In the enableVSyncInjections function of SurfaceFlinger, there is a possible use after free of mVSyncInjector. This could lead to a local elevation of privileg… |
CVE-2017-13183 | High | 7.0 | 2018-01-12 | In the OMXNodeInstance::useBuffer and IOMX::freeBuffer functions, there is a possible use after free due to a race condition if the user frees the buffer while… |
CVE-2017-13182 | High | 7.8 | 2018-01-12 | In the sendFormatChange function of ACodec, there is a possible integer overflow which could lead to an out-of-bounds write. This could lead to a local elevati… |
CVE-2017-13181 | High | 7.8 | 2018-01-12 | In the doGetThumb and getThumbnail functions of MtpServer, there is a possible double free due to not NULLing out a freed pointer. This could lead to an local… |
CVE-2017-13180 | High | 7.8 | 2018-01-12 | In the onQueueFilled function of SoftAVCDec, there is a possible out-of-bounds write due to a use after free if a bad header causes the decoder to get caught i… |
CVE-2017-13179 | Critical | 9.8 | 2018-01-12 | In the ihevcd_allocate_static_bufs and ihevcd_create functions of SoftHEVC, there is a possible out-of-bounds write due to a use after free. Both ps_codec_obj… |
CVE-2017-13178 | Critical | 9.8 | 2018-01-12 | In the initDecoder function of SoftAVCDec, there is a possible out-of-bounds write to mCodecCtx due to a use after free when buffer allocation fails. This coul… |
CVE-2017-13177 | Critical | 9.8 | 2018-01-12 | In several functions of libhevc, NEON registers are not preserved. This could lead to remote code execution as a privileged process with no additional executio… |